Authentication documentation in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this HTTP response with Bearer token?

Given this HTTP request header for authentication:

Authorization: Bearer abc123token

What is the expected server response status code if the token is valid?

A 200 OK

B 401 Unauthorized

C 403 Forbidden

D 500 Internal Server Error

💡 Hint

Think about what status code means success when token is valid.

A valid Bearer token means the user is authenticated, so the server responds with 200 OK. 401 means unauthorized (no or invalid token), 403 means forbidden (authenticated but no permission), 500 means server error.

🧠 Conceptual

intermediate

Which authentication method uses a shared secret key?

Choose the authentication method that relies on a shared secret key between client and server.

A OAuth 2.0 Authorization Code Flow

B API Key Authentication

C JWT (JSON Web Token) without secret

D Basic Authentication with username only

💡 Hint

Think about which method requires a secret key sent or stored by both client and server.

API Key Authentication uses a shared secret key that the client sends with requests. OAuth 2.0 uses tokens and authorization codes, JWT requires a secret to sign tokens but not shared directly, Basic Auth requires username and password.

🔧 Debug

advanced

Why does this API return 401 Unauthorized despite sending a token?

Consider this HTTP request header:

Authorization: Bearer

The server responds with 401 Unauthorized. What is the most likely cause?

A The server does not support Bearer tokens

B The token is expired but still sent

C The Authorization header is misspelled

D The Bearer token is missing after the word 'Bearer'

💡 Hint

Check the format of the Authorization header carefully.

The Authorization header must include the word 'Bearer' followed by a space and the token. Here, the token is missing, so the server rejects the request with 401 Unauthorized.

📝 Syntax

advanced

Which Authorization header is correctly formatted for Basic Auth?

Choose the correctly formatted Authorization header for Basic Authentication with username 'user' and password 'pass'.

A Authorization: Basic dXNlcjpwYXNz

B Authorization: Basic user:pass

C Authorization: Basic base64(user:pass)

D Authorization: Basic 'dXNlcjpwYXNz'

💡 Hint

Remember Basic Auth requires base64 encoding of 'username:password'.

The string 'user:pass' base64 encoded is 'dXNlcjpwYXNz'. The header must be 'Authorization: Basic ' followed by this encoded string without quotes.

🚀 Application

expert

How many scopes are granted in this OAuth 2.0 token response?

Given this OAuth 2.0 token response JSON:

{
  "access_token": "abc123",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read write delete"
}

How many scopes does this token grant?

A 2

B 1

C 3

D 4

💡 Hint

Count the number of space-separated scopes in the 'scope' field.

The 'scope' field contains three scopes: 'read', 'write', and 'delete'.